Transaction authorisation system & method

Abstract

A transaction authorisation system for allowing a customer to authorise transactions relating to an institution account, the system including a data storage for enabling access to identification data associated with the customer and a remote communication device (RCD) of the customer, and security identifier data associating the customer account with the identification data. The system also includes a communication device for receiving an authorisation request, which is referenced to the security identifier data, in relation to the transaction from the institution and for enabling communication with the customer via the RCD to authorise a transaction on the customer account. A system data processor identifies the customer and RCD using the identification data and determines if the transaction is authorised by the customer. The communication device provides an indication, which is referenced to the security identifier data, to the institution of whether or not the transaction is authorised by the customer.

Description

FIELD OF THE INVENTION[0001]The present invention relates to a system and method for the authorisation of transactions such as credit card purchases, bank transfers, and share purchases, particularly in environments where remote payments for goods and services are made.BACKGROUND OF THE INVENTION[0002]Security of financial and other types of transactions is of great importance due to the relatively recent growth of threats such as phishing and pharming which are intended to fraudulently acquire sensitive information, such as passwords, pin numbers and credit card details, by masquerading as a trustworthy person or business in an electronic communication. Once such details are fraudulently acquired they are utilised to make financial payments or to misappropriate funds from financial accounts. The account holder is often without any knowledge of these fraudulent transactions until after they have been concluded and it is too late to intervene. It is desirable, therefore, to seek auth...

AI Technical Summary

Benefits of technology

[0010]Broadly, the invention allows transactions, such as credit card payments, online banking funds transfers, or others, to be securely authorised by a customer, preferably before the transaction is concluded by the relevant institution. In one form, such authorisation occurs when the customer, prompted by an interactive voice response (IVR) system for example, provides one or more unique identifiers to validate his or her identity and authenticate the transaction. Alternatively, the customer may indicate that the transaction is fraudulent which is in turn communicated to the relevant institution so that appropriate actions may be taken. The information maintained by the authorisation system is separated from the account and customer records of the financial institution in order to maximise security in the authorisation process and mitigate the risk of fraudulent authentication of transactions that may arise as a result of unauthorised access to the stored information.

[0041]Use of a secure identifier such as a PIN which is memorised by the customer or biometric data (e.g. voice print, finger print, retina scan, behaviometric etc.) means that the transaction is only authorised once the identity of the customer, using information which is not normally available to a fraudulent person, is verified. A further advantage is provided by the fact that the customer's verification and contact details in the system are maintained in a separate data store to the customers bank details with only a single security identifier (known only to the bank's system and the authorisation system) linking the separated data stores. Such a setup provides increased security as unauthorised access to any one of the data stores on its own will not provide information adequate to circumvent the authorisation system and conduct fraudulent transactions.

Problems solved by technology

Once such details are fraudulently acquired they are utilised to make financial payments or to misappropriate funds from financial accounts.

The account holder is often without any knowledge of these fraudulent transactions until after they have been concluded and it is too late to intervene.

In current systems used to authorise financial transactions, it is difficult and often impossible to obtain a firm guarantee that the person initiating the transaction is the account holder and is authorised to conclude the transaction.

However, this process does not provide any form of verification that the individual making the transaction is indeed authorised to do so.

Although, a merchant may compare a signature an the credit card to the signature of the customer, such methods of verifying whether or not the transaction is fraudulent are far from foolproof.

Furthermore, the account holder and credit card provider are relying on the merchant to deny transactions that appear to be fraudulent and unauthorised.

This issue is particularly pronounced with transactions conducted in the online environment or over the telephone, where the merchant is unable to verify the customer's signature and therefore determine whether or not the transaction is fraudulent.

While the CVV code helps ascertain that the customer placing the order actually possesses the credit / debit card and that the card account is legitimate, this authentication procedure is ineffective when the card itself has been misappropriated or in scenarios where there has been unauthorised access to the financial records of the account holder.

Similarly, in current systems where the customer is required to provide a password or pin number before a transaction is authorised, unauthorised access to the account holder's records is likely to provide the information required to fraudulently authorise transactions.

Images